A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0775 advisory.

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

  - Jenkins: Session fixation vulnerability in OpenShift Login Plugin (CVE-2023-37946)

  - jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE (CVE-2024-23897)

  - jenkins: cross-site WebSocket hijacking (CVE-2024-23898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0778 advisory.

  - google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

  - maven: Block repositories using http by default (CVE-2021-26291)

  - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - guava: insecure temporary directory creation (CVE-2023-2976)

  - springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)

  - spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout (CVE-2023-20862)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()     (CVE-2023-26048)

  - jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

  - Jenkins: Open redirect vulnerability in OpenShift Login Plugin (CVE-2023-37947)

  - jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)

  - jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin (CVE-2023-40337)

  - jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin (CVE-2023-40338)

  - jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin     (CVE-2023-40339)

  - jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials     (CVE-2023-40341)

  - jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE (CVE-2024-23897)

  - jenkins: cross-site WebSocket hijacking (CVE-2024-23898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6171 advisory.

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0776 advisory.

  - maven: Block repositories using http by default (CVE-2021-26291)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Session fixation vulnerability in OpenShift Login Plugin (CVE-2023-37946)

  - jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE (CVE-2024-23897)

  - jenkins: cross-site WebSocket hijacking (CVE-2024-23898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0777 advisory.

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - guava: insecure temporary directory creation (CVE-2023-2976)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - jackson-databind: denial of service via cylic dependencies (CVE-2023-35116)

  - Jenkins: Session fixation vulnerability in OpenShift Login Plugin (CVE-2023-37946)

  - Jenkins: Open redirect vulnerability in OpenShift Login Plugin (CVE-2023-37947)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

  - jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin may approve unsandboxed scripts     (CVE-2023-40336)

  - jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin (CVE-2023-40337)

  - jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin (CVE-2023-40338)

  - jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin     (CVE-2023-40339)

  - jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials     (CVE-2023-40341)

  - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6179 advisory.

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

  - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6172 advisory.

  - google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3195 advisory.

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3610 advisory.

  - jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)

  - Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

  - springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)

  - springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin (CVE-2023-32977)

  - jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility     Steps Plugin (CVE-2023-32981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory.

  - kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)

  - spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client (CVE-2022-31690)

  - spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring     Security (CVE-2022-31692)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - haproxy: request smuggling attack in HTTP/1 header parsing (CVE-2023-25725)

  - Jenkins: XSS vulnerability in plugin manager (CVE-2023-27898)

  - Jenkins: Temporary plugin file created with insecure permissions (CVE-2023-27899)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3198 advisory.

  - maven: Block repositories using http by default (CVE-2021-26291)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)

  - Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin     (CVE-2022-43401, CVE-2022-43403, CVE-2022-43404)

  - jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin (CVE-2022-43402)

  - jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin     (CVE-2022-43405)

  - jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy     Libraries Plugin (CVE-2022-43406)

  - jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step     Plugin (CVE-2022-43407)

  - jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View     Plugin (CVE-2022-43408)

  - jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin     (CVE-2022-43409)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3299 advisory.

  - google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

  - kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)

  - jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

  - springframework: Authorization Bypass in RegexRequestMatcher (CVE-2022-22978)

  - com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson (CVE-2022-25647)

  - xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40151)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Denial of Service attack (CVE-2023-27900, CVE-2023-27901)

  - Jenkins: Workspace temporary directories accessible through directory browser (CVE-2023-27902)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7288 advisory.

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

  - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory.

  - Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could     be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify     a request initiated by the Client (via the browser) to the Authorization Server which can lead to a     privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server     responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1)     on the subsequent request to the token endpoint to obtain the access token. (CVE-2022-31690)

  - Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization     rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all     of the following are true: The application expects that Spring Security applies security to forward and     include dispatcher types. The application uses the AuthorizationFilter either manually or via the     authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or     include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include).
    The application may forward or include the request to a higher privilege-secured endpoint.The application     configures Spring Security to apply to every dispatcher type via     authorizeHttpRequests().shouldFilterAllDispatcherTypes(true) (CVE-2022-31692)

  - A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client     traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the     client's API server credentials to third parties. (CVE-2022-3172)

  - Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and     expanded. The standard format for interpolation is ${prefix:name}, where prefix is used to locate an     instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with     version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that     could result in arbitrary code execution or contact with remote servers. These lookups are: - script -     execute expressions using the JVM script execution engine (javax.script) - dns - resolve dns records -     url - load values from urls, including from remote servers Applications using the interpolation defaults     in the affected versions may be vulnerable to remote code execution or unintentional contact with remote     servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons     Text 1.10.0, which disables the problematic interpolators by default. (CVE-2022-42889)

  - A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin     1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts,     including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the     Jenkins controller JVM. (CVE-2023-24422)

  - HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in     some situations, aka request smuggling. The HTTP header parsers in HAProxy may accept empty header field     names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after     being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because     the headers disappear before being parsed and processed, as if they had not been sent by the client. The     fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31. (CVE-2023-25725)

  - Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape     the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with     the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable     by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins     instances. (CVE-2023-27898)

  - Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary     directory with the default permissions for newly created files when uploading a plugin for installation,     potentially allowing attackers with access to the Jenkins controller file system to read and write the     file before it is used, potentially resulting in arbitrary code execution. (CVE-2023-27899)

  - Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary     directory with the default permissions for newly created files when uploading a file parameter through the     CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write     the file before it is used. (CVE-2023-27903)

  - Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when     agent connections are broken, potentially revealing information about Jenkins configuration that is     otherwise inaccessible to attackers. (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - High Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts,     including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script     are intercepted, and various allowlists are checked to determine whether the call is to be allowed. In     Script Security Plugin 1228.vd93135a_2fb_25 and earlier, property assignments performed implicitly by the     Groovy language runtime when invoking map constructors were not intercepted by the sandbox. This     vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines,     to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
    Script Security Plugin 1229.v4880b_b_e905a_6 intercepts property assignments when invoking map     constructors. As part of this fix, map constructors may only be invoked in the sandbox using the new key.
    Attempting to invoke a map constructor using a Groovy cast will fail unconditionally. For example, code     such as [key: value] as MyClass or MyClass mc = [key: value] must be converted to use new MyClass(key:
    value) instead. (CVE-2023-24422)

  - Medium Gerrit Trigger Plugin 2.38.0 and earlier does not require POST requests for several HTTP endpoints,     resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to     rebuild previous builds triggered by Gerrit. Gerrit Trigger Plugin 2.38.1 requires POST requests for the     affected HTTP endpoints. (CVE-2023-24423)

  - High OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the existing session on     login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins.
    OpenId Connect Authentication Plugin 2.5 invalidates the existing session on login. (CVE-2023-24424)

  - Medium Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate     context for Kubernetes credentials lookup, allowing the use of System-scoped credentials otherwise     reserved for the global configuration. This allows attackers with Item/Configure permission to access and     potentially capture Kubernetes credentials they are not entitled to. Kubernetes Credentials Provider     Plugin 1.209.v862c6e5fb_1ef defines the appropriate context for Kubernetes credentials lookup.
    (CVE-2023-24425)

  - High Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the existing session on login.
    This allows attackers to use social engineering techniques to gain administrator access to Jenkins. Azure     AD Plugin 306.va_7083923fd50 invalidates the existing session on login. (CVE-2023-24426)

  - High Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the existing session on login. This     allows attackers to use social engineering techniques to gain administrator access to Jenkins. Bitbucket     OAuth Plugin 0.13 invalidates the existing session on login. (CVE-2023-24427)

  - Medium Bitbucket OAuth Plugin 0.12 and earlier does not implement a state parameter in its OAuth flow, a     unique and non-guessable value associated with each authentication request. This vulnerability allows     attackers to trick users into logging in to the attacker's account. Bitbucket OAuth Plugin 0.13 implements     a state parameter in its OAuth flow. (CVE-2023-24428)

  - High Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and     its XML parser is not configured to prevent XML external entity (XXE) attacks. Semantic Versioning Plugin     1.14 and earlier does not restrict execution of the controller/agent message to agents, and implements no     limitations about the file path that can be parsed. This allows attackers able to control agent processes     to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the     Jenkins controller or server-side request forgery. This is due to an incomplete fix of SECURITY-2124. This     vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS     upgrade guide. Semantic Versioning Plugin 1.15 does not allow the affected controller/agent message to be     submitted by agents for execution on the controller. (CVE-2023-24429)

  - Medium Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML     external entity (XXE) attacks. This allows attackers able to control the contents of the version file for     the 'Determine Semantic Version' build step to have agent processes parse a crafted file that uses     external entities for extraction of secrets from the Jenkins agent or server-side request forgery. Because     Jenkins agent processes usually execute build tools whose input (source code, build scripts, etc.) is     controlled externally, this vulnerability only has a real impact in very narrow circumstances: when     attackers can control XML files, but are unable to change build steps, Jenkinsfiles, test code that gets     executed on the agents, or similar. Semantic Versioning Plugin 1.15 disables external entity resolution     for its XML parser. (CVE-2023-24430)

  - Medium Orka by MacStadium Plugin 1.31 and earlier does not perform permission checks in several HTTP     endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials     stored in Jenkins. Those can be used as part of an attack to capture the credentials using another     vulnerability. An enumeration of credentials IDs in Orka by MacStadium Plugin 1.32 requires     Overall/Administer permission. (CVE-2023-24431)

  - Medium Orka by MacStadium Plugin 1.31 and earlier does not perform permission checks in several HTTP     endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP     server using attacker-specified credentials IDs obtained through another method, capturing credentials     stored in Jenkins. Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-     site request forgery (CSRF) vulnerability. Orka by MacStadium Plugin 1.32 requires POST requests and     Overall/Administer permission for the affected HTTP endpoints. (CVE-2023-24432, CVE-2023-24433)

  - Medium GitHub Pull Request Builder Plugin 1.42.2 and earlier does not perform a permission check in an     HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of     credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using     another vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this.
    (CVE-2023-24436)

  - Medium GitHub Pull Request Builder Plugin 1.42.2 and earlier does not perform permission checks in methods     implementing form validation. This allows attackers with Overall/Read permission to connect to an     attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing     credentials stored in Jenkins. Additionally, these form validation methods do not require POST requests,     resulting in a cross-site request forgery (CSRF) vulnerability. As of publication of this advisory, there     is no fix. Learn why we announce this. (CVE-2023-24434, CVE-2023-24435)

  - Medium JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier does not perform permission checks in     methods implementing form validation. This allows attackers with Overall/Read permission to connect to an     attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing     credentials stored in Jenkins. Additionally, these form validation methods do not require POST requests,     resulting in a cross-site request forgery (CSRF) vulnerability. As of publication of this advisory, there     is no fix. Learn why we announce this. (CVE-2023-24437, CVE-2023-24438)

  - Low JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private key unencrypted in its     global configuration file org.thoughtslive.jenkins.plugins.jira.JiraStepsConfig.xml on the Jenkins     controller as part of its configuration. This key can be viewed by users with access to the Jenkins     controller file system. Additionally, the global configuration form does not mask the API key, increasing     the potential for attackers to observe and capture it. As of publication of this advisory, there is no     fix. Learn why we announce this. (CVE-2023-24439, CVE-2023-24440)

  - Medium MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity     (XXE) attacks. This allows attackers able to control the contents of the report file for the 'Publish     MSTest test result report' post-build step to have agent processes parse a crafted file that uses external     entities for extraction of secrets from the Jenkins agent or server-side request forgery. Because Jenkins     agent processes usually execute build tools whose input (source code, build scripts, etc.) is controlled     externally, this vulnerability only has a real impact in very narrow circumstances: when attackers can     control XML files, but are unable to change build steps, Jenkinsfiles, test code that gets executed on the     agents, or similar. As of publication of this advisory, there is no fix. Learn why we announce this.
    (CVE-2023-24441)

  - Low GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token,     Sonar access token and Sonar password unencrypted in its global configuration file     com.github.terma.jenkins.githubprcoveragestatus.Configuration.xml on the Jenkins controller as part of its     configuration. These credentials can be viewed by users with access to the Jenkins controller file system.
    As of publication of this advisory, there is no fix. Learn why we announce this. (CVE-2023-24442)

  - High Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the existing session on login.
    This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of     publication of this advisory, there is no fix. Learn why we announce this. (CVE-2023-24456)

  - Medium Keycloak Authentication Plugin 2.3.0 and earlier does not implement a state parameter in its OAuth     flow, a unique and non-guessable value associated with each authentication request. This vulnerability     allows attackers to trick users into logging in to the attacker's account. As of publication of this     advisory, there is no fix. Learn why we announce this. (CVE-2023-24457)

  - High TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML     external entity (XXE) attacks. This allows attackers able to control the zip archive input file for the     'TestComplete Test' build step to have Jenkins parse a crafted file that uses external entities for     extraction of secrets from the Jenkins controller or server-side request forgery. As of publication of     this advisory, there is no fix. Learn why we announce this. (CVE-2023-24443)

  - High OpenID Plugin 2.4 and earlier does not invalidate the existing session on login. This allows     attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication     of this advisory, there is no fix. Learn why we announce this. (CVE-2023-24444)

  - Medium OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately     pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL     that will forward them to a different site after successful authentication. As of publication of this     advisory, there is no fix. Learn why we announce this. (CVE-2023-24445)

  - Medium OpenID Plugin 2.4 and earlier does not implement a state parameter in its OAuth flow, a unique and     non-guessable value associated with each authentication request. This vulnerability allows attackers to     trick users into logging in to the attacker's account. As of publication of this advisory, there is no     fix. Learn why we announce this. (CVE-2023-24446)

  - Medium RabbitMQ Consumer Plugin 2.8 and earlier does not perform a permission check in a method     implementing form validation. This allows attackers with Overall/Read permission to connect to an     attacker-specified AMQP server using attacker-specified username and password. Additionally, this form     validation method does not require POST requests, resulting in a cross-site request forgery (CSRF)     vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this.
    (CVE-2023-24447, CVE-2023-24448)

  - Medium PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods     implementing form validation. This allows attackers with Overall/Read permission to check for the     existence of an attacker-specified file path on the Jenkins controller file system. As of publication of     this advisory, there is no fix. Learn why we announce this. (CVE-2023-24449)

  - Medium view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the     Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended     Read permission or access to the Jenkins controller file system. As of publication of this advisory, there     is no fix. Learn why we announce this. (CVE-2023-24450)

  - Medium Cisco Spark Notifier Plugin 1.1.1 and earlier does not perform permission checks in several HTTP     endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials     stored in Jenkins. Those can be used as part of an attack to capture the credentials using another     vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this.
    (CVE-2023-24451)

  - Medium BearyChat Plugin 3.0.2 and earlier does not perform a permission check in a method implementing     form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified     URL. Additionally, this form validation method does not require POST requests, resulting in a cross-site     request forgery (CSRF) vulnerability. As of publication of this advisory, there is no fix. Learn why we     announce this. (CVE-2023-24458, CVE-2023-24459)

  - Medium TestQuality Updater Plugin 1.3 and earlier does not perform a permission check in a method     implementing form validation. This allows attackers with Overall/Read permission to connect to an     attacker-specified URL using attacker-specified username and password. Additionally, this form validation     method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. As     of publication of this advisory, there is no fix. Learn why we announce this. (CVE-2023-24452,     CVE-2023-24453)

  - Low TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its     global configuration file com.testquality.jenkins.TestQualityNotifier.xml on the Jenkins controller as     part of its configuration. This password can be viewed by users with access to the Jenkins controller file     system. As of publication of this advisory, there is no fix. Learn why we announce this. (CVE-2023-24454)

  - Medium visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing     form validation. This allows attackers with Item/Configure permission to check for the existence of an     attacker-specified file path on the Jenkins controller file system. As of publication of this advisory,     there is no fix. Learn why we announce this. (CVE-2023-24455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.7. It is, therefore, affected by multiple vulnerabilities including the following:

  - Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - CSRF vulnerability in Gerrit Trigger Plugin (CVE-2023-24423)

  - Session fixation vulnerability in OpenId Connect Authentication Plugin (CVE-2023-24424)

  - Exposure of system-scoped Kubernetes credentials in Kubernetes Credentials Provider Plugin     (CVE-2023-24425)

  - Session fixation vulnerability in Azure AD Plugin (CVE-2023-24426)

  - Session fixation vulnerability in Bitbucket OAuth Plugin (CVE-2023-24427)

  - CSRF vulnerability in Bitbucket OAuth Plugin (CVE-2023-24428)

  - Agent-to-controller security bypass in Semantic Versioning Plugin (CVE-2023-24429)

  - XXE vulnerability on agents in Semantic Versioning Plugin (CVE-2023-24430)

  - Missing permission checks in Orka by MacStadium Plugin allow enumerating credentials IDs (CVE-2023-24431)

  - CSRF vulnerability and missing permission checks in Orka by MacStadium Plugin allow capturing credentials     (CVE-2023-24432, CVE-2023-24433)

  - CSRF vulnerability and missing permission checks in GitHub Pull Request Builder Plugin (CVE-2023-24434,     CVE-2023-24435)

  - Missing permission check in GitHub Pull Request Builder Plugin allows enumerating credentials IDs     (CVE-2023-24436)

  - CSRF vulnerability and missing permission checks in JIRA Pipeline Steps Plugin (CVE-2023-24437,     CVE-2023-24438)

  - Keys stored in plain text by JIRA Pipeline Steps Plugin (CVE-2023-24439, CVE-2023-24440)

  - XXE vulnerability on agents in MSTest Plugin (CVE-2023-24441)

  - Credentials stored in plain text by GitHub Pull Request Coverage Status Plugin (CVE-2023-24442)

  - XXE vulnerability in TestComplete support Plugin (CVE-2023-24443)

  - Session fixation vulnerability in OpenID Plugin (CVE-2023-24444)

  - Open redirect vulnerability in OpenID Plugin (CVE-2023-24445)

  - CSRF vulnerability in OpenID Plugin (CVE-2023-24446)

  - CSRF vulnerability and missing permission check in RabbitMQ Consumer Plugin (CVE-2023-24447,     CVE-2023-24448)

  - Path traversal vulnerability in PWauth Security Realm Plugin (CVE-2023-24449)

  - Passwords stored in plain text by view-cloner Plugin (CVE-2023-24450)

  - Missing permission checks in Cisco Spark Notifier Plugin allow enumerating credentials IDs     (CVE-2023-24451)

  - CSRF vulnerability and missing permission check in TestQuality Updater Plugin (CVE-2023-24452,     CVE-2023-24453)

  - Password stored in plain text by TestQuality Updater Plugin (CVE-2023-24454)

  - Path traversal vulnerability in visualexpert Plugin (CVE-2023-24455)

  - Session fixation vulnerability in Keycloak Authentication Plugin (CVE-2023-24456)

  - CSRF vulnerability in Keycloak Authentication Plugin (CVE-2023-24457)

  - CSRF vulnerability and missing permission check in BearyChat Plugin (CVE-2023-24458, CVE-2023-24459)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194437	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2024:0775)	Nessus	Red Hat Local Security Checks	critical
194435	RHEL 8 : Jenkins and Jenkins-2-plugins (RHSA-2024:0778)	Nessus	Red Hat Local Security Checks	critical
194410	RHEL 8 : Red Hat Product OCP Tools 4.11 Openshift Jenkins (RHSA-2023:6171)	Nessus	Red Hat Local Security Checks	critical
194395	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2024:0776)	Nessus	Red Hat Local Security Checks	critical
194374	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2024:0777)	Nessus	Red Hat Local Security Checks	critical
194368	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2023:6179)	Nessus	Red Hat Local Security Checks	critical
194352	RHEL 8 : Red Hat Product OCP Tools 4.12 Openshift Jenkins (RHSA-2023:6172)	Nessus	Red Hat Local Security Checks	critical
194325	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3195)	Nessus	Red Hat Local Security Checks	critical
194324	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3610)	Nessus	Red Hat Local Security Checks	critical
194304	RHEL 7 / 8 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)	Nessus	Red Hat Local Security Checks	critical
194295	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)	Nessus	Red Hat Local Security Checks	critical
194250	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3299)	Nessus	Red Hat Local Security Checks	critical
193753	RHEL 8 : Red Hat Product OCP Tools 4.14 Openshift Jenkins (RHSA-2023:7288)	Nessus	Red Hat Local Security Checks	critical
189435	RHCOS 4 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)	Nessus	Red Hat Local Security Checks	critical
171929	Jenkins plugins Multiple Vulnerabilities (2023-01-24)	Nessus	CGI abuses	critical
170555	Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.7 Multiple Vulnerabilities (CloudBees Security Advisory 2023-01-24)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2023-24422

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical